values.seed.example.yaml

# Copyright 2020 The Kubermatic Kubernetes Platform contributors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

minio:
  storeSize: '200Gi'
  storageClass: kubermatic-backup
  credentials:
    # generated access key length should be at least 3 characters
    accessKey: "YOUR-ACCESS-KEY"
    # generated secret key length should be at least 8 characters
    secretKey: "YOUR-SECRET-KEY"

#-------------------------------------------------------------------------------Seed MLA stack 
prometheus:
  host: prometheus.mla.seed.kkp.example.com
  storageSize: '250Gi'
  tsdb:
    retentionTime: '30d'
  # only load the KKP-master alerts, as this cluster is not a shared master/seed
  ruleFiles:
  - /etc/prometheus/rules/general-*.yaml
  - /etc/prometheus/rules/kubermatic-seed-*.yaml
  - /etc/prometheus/rules/managed-*.yaml
  - /etc/prometheus/rules/usercluster-mla-*.yaml

alertmanager:
  host: alertmanager.mla.seed.kkp.example.com

grafana:
  user: admin
  password: adm1n
  provisioning:
    configuration:
      auto_assign_org_role: Editor
      disable_login_form: false
      root_url: https://grafana.mla.seed.kkp.example.com
    datasources:
      lokiServices:
        - loki
      prometheusService:
        - prometheus

loki:
  persistence:
    size: '100Gi'

#-----------------------------------------------------------------------------------IAP
iap:
    oidc_issuer_url: https://keycloak.example.com/realms/realm-id # Update the KeyCloak realm URL to be used.
    deployments:
        prometheus:
            name: prometheus
            ingress:
                host: prometheus.mla.seed.kkp.example.com
            upstream_service: prometheus.monitoring.svc.cluster.local
            upstream_port: 9090
            client_id: seed-mla
            # client_secret is the "secret" from the KeyCloak client "seed-mla" config
            client_secret: <copy value from KeyCloak>
            # generate a fresh secret key here
            encryption_key: <generate random secret key here>
            config:
                scope: openid email profile roles groups
                email_domains:
                    - kkp.example.com
                insecure_oidc_allow_unverified_email: "true" # TO BE Removed later if added email domain is valid and emails are verified
                pass_user_headers: true
                skip_auth_regex:
                    - /-/health
        alertmanager:
            name: alertmanager
            ingress:
                host: alertmanager.mla.seed.kkp.example.com
            upstream_service: alertmanager.monitoring.svc.cluster.local
            upstream_port: 9093
            client_id: seed-mla
            # client_secret is the "secret" from the KeyCloak client "seed-mla" config
            client_secret: <copy value from KeyCloak>
            # generate a fresh secret key here
            encryption_key: <generate random secret key here>
            config:
                scope: openid email profile roles groups
                email_domains:
                    - kkp.example.com
                insecure_oidc_allow_unverified_email: "true" # TO BE Removed later if added email domain is valid and emails are verified
                pass_user_headers: true
                skip_auth_regex:
                    - /-/health
        grafana:
            name: grafana
            ingress:
                host: grafana.mla.seed.kkp.example.com
            upstream_service: grafana.monitoring.svc.cluster.local
            upstream_port: 3000
            client_id: seed-mla
            # client_secret is the "secret" from the KeyCloak client "seed-mla" config
            client_secret: <copy value from KeyCloak>
            # generate a fresh secret key here
            encryption_key: <generate random secret key here>
            config:
                scope: openid email profile roles groups
                email_domains:
                    - kkp.example.com
                insecure_oidc_allow_unverified_email: "true" # TO BE Removed later if added email domain is valid and emails are verified
                pass_user_headers: true
                skip_auth_regex:
                    - /api/health
        karma:
            name: karma
            ingress:
                host: karma.mla.seed.kkp.example.com
            upstream_service: karma.monitoring.svc.cluster.local
            upstream_port: 8080
            client_id: seed-mla
            # client_secret is the "secret" from the KeyCloak client "seed-mla" config
            client_secret: <copy value from KeyCloak>
            # generate a fresh secret key here
            encryption_key: <generate random secret key here>
            config:
                scope: openid email profile roles groups
                email_domains:
                    - kkp.example.com
                insecure_oidc_allow_unverified_email: "true" # TO BE Removed later if added email domain is valid and emails are verified
                pass_user_headers: true
    certIssuer:
      name: letsencrypt-prod
      kind: ClusterIssuer